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Washington, DC 20548 



December 17, 2007 
Congressional Addressees: 

Subject: Plum Island Animal Disease Center: DHS Has Made Significant Progress 
Implementing Security Recommendations, but Several Recommendations Remain 
Open 



For many years, the Department of Agriculture (USDA) owned and operated the 
Plum Island Animal Disease Center, located on an island in the Long Island Sound off 
the coast of New York. Scientists at Plum Island, often with the assistance of 
scientists from other countries, diagnose the pathogens that cause foreign animal 
diseases and then conduct research to, among other things, develop vaccines to 
protect against them. Some of the pathogens maintained at Plum Island, such as foot- 
and-mouth disease, are highly contagious to livestock and could cause catastrophic 
economic losses in the agricultural sector if they are released outside the facility. 
Other pathogens known to have been maintained at Plum Island could also cause 
illness and death in humans. For these reasons, USDA conducts its work on Plum 
Island within a sealed biocontainment area that has special safety features designed 
to contain the pathogens. 

After the terrorist attacks on the United States, new laws and regulations required 
officials at the Plum Island Animal Disease Center to further restrict access to the 
pathogens in order to protect animal health and, thereby, also help reduce the 
possibility of bioterrorism. In addition, Plum Island and its assets and liabilities were 
transferred from USDA to the Department of Homeland Security (DHS). 1 Today, 
USDA continues to conduct its diagnostic and research work on Plum Island, but it 
now does so in coordination with DHS as part of a broader joint strategy to protect 
against the intentional or accidental introduction of foreign animal diseases. In 2005, 
we reported that, as part of that strategy, DHS had started to develop plans to replace 
the Plum Island Animal Disease Center with a new, modernized facility. 2 Since then, 
DHS has selected six possible sites for this new facility, including Plum Island. This 
planned higher-level biosecurity facility will enable the department to expand the 



'The Homeland Security Act of 2002 (Pub. L. No. 107-296, §310, 116 Stat. 2135, 2174). 

2 See GAO, Plum Island Animal Disease Center: DHS and USDA Are Successfully Coordinating 
Current Work, but Long-Term Plans Are Being Assessed, GAO-06-132 (Washington, D.C.: Dec. 19, 
2005). 
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research currently conducted on the island to include work on higher-consequence 
biological threats posed by zoonotic (i.e., transmittable from animals to humans) and 
foreign animal diseases. 3 

Prior to Plum Island's transfer from USDA to DHS, 71 employees of the contractor 
USDA had hired to operate and maintain the facility went on strike. This strike, 
accompanied by sabotage of the island's infrastructure, heightened already existing 
concerns that someone might try to steal certain pathogens from the facility to 
conduct terrorist activities. In this context, the Congress asked us to review, among 
other things, the adequacy of security at Plum Island. In 2003, we reported that 
although security at Plum Island had improved since the terrorist attacks, the facility 
was vulnerable to security breaches because physical security arrangements were 
incomplete and limited, officials had been assuming unnecessary risks by not 
adequately controlling access to areas where pathogens were located, incident 
response capability was limited, and the full array of risks and threats to Plum Island 
were not sufficiently considered. 4 We made 24 recommendations to the Secretary of 
Homeland Security to help the department overcome these limitations. DHS agreed 
with the report and its recommendations. 

As a part of our routine audit work, we have been tracking the status of the 2003 
Plum Island security recommendations. In addition, in May 2007, we received a 
request from Senator Charles Schumer to report on this matter. On September 28, 
2007, we briefed interested congressional staff on the extent to which DHS had 
implemented the recommendations at that time. Because of broad-based 
congressional interest, under the Comptroller General's statutory authority to 
conduct evaluations on his own initiative, we are issuing this report, which 
summarizes that briefing. (A list of addressees receiving this report appears on the 
last page of this letter). To evaluate DHS's efforts to implement the Plum Island 
security recommendations, we reviewed pertinent DHS and USDA documents; 
interviewed DHS, USDA, and other personnel responsible for Plum Island's security; 
and, during a visit to Plum Island in 2005, observed improvements in physical security 
and the procedures securing the biocontainment well as the facility's 

infrastructure. However, we did not conduct a comprehensive audit of all decisions 
that DHS and USDA have made to improve Plum Island security. We provided DHS 
and USDA an opportunity to verify facts of this report. Officials from both agencies 
provided us with additional information, which has been incorporated into this 
report. We performed our work from February 2004 through December 2007. 

In summary, DHS has made significant progress and has implemented 18 of the 24 
recommendations. However, implementation of the 6 remaining recommendations is 
still under way. The following highlights DHS actions to address our 
recommendations and discusses those that remain in progress. Enclosure I lists all 24 
recommendations and their status. 



'For more information on higher-level biosecurity facilities see GAO, High-Containment Biosafety 
Laboratories: Preliminary Observations on the Oversight of the Proliferation of BSL-3 and BSL-4 
Laboratories in the United States, GAO-08-108T (Washington, D.C.: Oct. 4, 2007). 

4 GAO, Combating Bioterrorism: Actions Needed to Improve Security at Plum Island Animal Disease 
Center, GAO-03-847 (Washington, D.C.: Sept. 19, 2003). 
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Addressing Physical Security Deficiencies 

In 2003, physical security at Plum Island was deficient in several ways. For example, 
alarms and door sensors for detecting intruders were not fully operational; controls 
to account for the keys to the island's facilities were deficient; and USDA was not 
providing sufficient physical security for certain assets, including those critical to the 
continued operation of the facility. These vulnerabilities were particularly troubling 
because a strike was under way, and sabotage of the island's infrastructure had 
already occurred. DHS has since taken many actions in response to our 
recommendations. For example, alarms and door sensors are now in use, and DHS 
has implemented procedures to better control access to keys to facilities. In addition, 
the department has better secured certain features of the physical infrastructure that 
supports the continued operation of the Plum Island Animal Disease Center. DHS has 
also improved the security of North America's only foot-and-mouth disease vaccine 
bank. This bank represents years of cooperative research performed by Canada, 
Mexico, and the United States, and the material it contains is considered a critical 
asset for controlling a large outbreak. 

The implementation of two of our recommendations to enhance physical security 
remains in progress. 

• First, we had reported that the island's contracted security force reported to 
the administrative contract officer rather than to the security director — a 
situation that could have impeded prompt resolution of security-related issues. 
DHS agreed that this was problematic and told us the department was 
initiating changes to the security contract that would allow the security force 
to report directly to the security director. DHS also told us that changing the 
contract was dependent on resolution of a contract bid protest of the contract 
award submitted to GAO. Since our briefing, GAO's General Counsel has 
issued a decision leaving DHS free to make the necessary contract changes. 6 
Subsequently, on November 1, 2007, DHS entered into a new security contract. 
DHS officials told us that the contract provides for the security force to report 
directly to the security director effective January 1, 2008. 

• Second, we also reported that USDA had no procedure for ensuring that 
contractors and visitors entering the biocontainment area did not have 
criminal backgrounds. We recommended that DHS check the backgrounds of 
these individuals before granting them access, using, for example, the National 
Crime Information Center (NCIC). 6 According to DHS officials, the department 
is developing a memorandum of agreement with the Federal Protective 
Service (FPS) 7 that will provide full-time FPS presence on the island with the 



5 See M&M Investigations, Inc., B-299369.2, B-299369.3, Oct. 24, 2007, 2007 CPD. 

b NCIC is operated by the Federal Bureau of Investigation (FBI) and provides federal, state, and local 
law enforcement and other criminal justice agencies with, among other things, information on criminal 
history records. 

7 FPS transferred from the General Services Administration to DHS in March 2003 and has 
responsibility for protecting federal facilities. 



Page 3 



GAO-08-306R Plum Island Security Update 



capability to verify contractors' and visitors' backgrounds using NCIC before 
these individuals enter the biocontainment area. However, this agreement has 
not yet been finalized because DHS has not determined how it will pay for 
maintaining FPS on the island 24 hours a day, 7 days a week. The expense of 
this arrangement was not planned for or included in DHS' current budget. 

Limiting Access to Pathogens 

In 2003, we reported that USDA was not adequately controlling access to the 
pathogens. For example, we found that 12 Plum Island employees, some with access 
to pathogens, had not had their background checks updated in more than 10 years, 
even though USDA had told us that background checks were updated every 5 years. 
Also, we found that as many as five cleaning, maintenance, and repair staff — who are 
not required to have background checks but are required to be escorted by an 
approved individual — were working in the biocontainment area without escorts. 
DHS has taken several actions in response to our recommendations. For example, 
DHS has developed a process to update background checks on a regular basis and 
has developed a line-of-sight escort policy that requires all cleaning, maintenance, 
and repair staff entering the biocontainment area to be continually monitored by 
individuals with completed background checks. According to DHS officials, if an 
escort is not available, unapproved individuals are not permitted access to the area. 

However, DHS has not fully implemented our recommendation that the department 
ensure that individuals involved in laboratory activities in the biocontainment area — 
including students and regardless of citizenship — be approved in accordance with the 
law. Specifically, in 2003, we reported that USDA did not require background checks 
on students attending its foreign animal disease diagnostic classes that were regularly 
held in the biocontainment area. We stated that this practice might not have been 
consistent with the regulations implementing the Agricultural Bioterrorism 
Preparedness Act of 2002. 8 According to the regulations, individuals with access to 
pathogens should undergo background investigations. However, these regulations 
also allow the Administrator of USDA's Animal and Plant Health Inspection Service 
to exempt individuals from background investigations if the Administrator 
determines there is good cause and if doing so is consistent with protecting animal 
health or animal products. 

USDA officials recently told us that it has provided such an exemption for the 
students attending its foreign animal disease diagnostic classes. USDA's position is 
that background investigations are not required because the risk of a student 
removing a pathogen is exceedingly low, largely due to what USDA calls "unique and 
extraordinary security measures" it has taken for students. According to USDA, these 
measures include denying students access to areas where pathogens are stored or 
equipment necessary to extract the pathogen from the tissue of the infected animal; 
not allowing students to inoculate animals with the pathogens or to analyze animal 
tissue or to isolate the disease from tissues; requiring students to be escorted at all 
times by approved individuals while in the biocontainment area; and requiring 
students to shower twice and completely change clothing between showers while 
being continuously escorted. Any remaining risk is acceptable, according to USDA, 



'See Pub. L. No. 107-188, Tit. II, § 212, 116 Stat. 647. 



Page 4 



GAO-08-306R Plum Island Security Update 



given the catastrophic risks associated with not having adequately trained 
professionals who can accurately diagnose and treat foreign animal diseases. 

While we recognize the importance of maintaining a cadre of trained animal disease 
professionals, we continue to find it troubling that students are not subject to any 
type of background check before handling animals infected with diseases that have 
been determined to pose a severe threat to animal health and the economy. DHS 
officials recently told us that they are conducting background checks on international 
visitors, including those attending the foreign animal disease diagnostic classes. DHS 
officials also plan to do background checks on all individuals entering the 
biocontainment area using NCIC, once FPS is on the island full time. However, DHS 
does not yet have a firm timetable for when this will take place. Until this occurs, 
DHS continues to follow USDA policy permitting U.S. students to attend the classes 
without background checks. 

Enhancing Incident Response Capability 

In 2003, we also found the island's incident response capability to be limited. For 
example, although the small guard force carried firearms, it was not authorized to do 
so; and no policy was put in place defining if, when, and how guards should use their 
weapons. In addition, because no formal arrangements with local law enforcement 
existed in 2003, Plum Island officials were unable to predict the extent to which 
surrounding localities would provide backup assistance during an incident. DHS has 
since taken actions to overcome these response limitations. For example, the guard 
force on the island is now authorized to carry weapons, in accordance with New York 
state law, and policies and procedures are in place detailing how guards should deal 
with intruders. DHS also recently established a memorandum of agreement with the 
town of Southold, NY, to provide law enforcement backup assistance when 
necessary. As a result, even though the guards do not yet have arrest authority, they 
can detain an individual on the island until Southold police arrive and make arrests, if 
necessary. The agreement with Southold also defines response times according to the 
type of assistance required — such as marine and canine patrol support — and provides 
for additional support from the Suffolk County Police Department — such as 
helicopters, explosive ordinance disposal capability, and other incident response 
assets — when warranted. 

The implementation of two of our recommendations to enhance incident response 
capability remains in progress. 

• First, we recommended that DHS develop an incident response plan that 
included precise detail about what to do if an incident occurred that exceeded 
the capability of the security system, such as a terrorist attack. In 2003, the 
island's incident response plan contained certain elements required under 
USDA regulation, such as how to respond to a bomb threat, but the plan did 
not clearly lay out the actions to be taken for incidents exceeding Plum 
Island's security capabilities. This was critical because at that time, according 
to DHS officials, the nation faced a significant risk of a terrorist attack. 
Although, in January 2007, DHS entered into a memorandum of agreement to 
obtain backup assistance from the town of Southold, DHS has not yet updated 
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its incident response plan reflecting these new capabilities, but told us it 
intends to do so. 

• Second, we recommended that DHS conduct exercises with local law 

enforcement to test the efficiency and effectiveness of Plum Island's response 
capability. DHS agreed that it would be important to conduct such exercises 
once arrangements with local law enforcement were made. DHS conducted 
one exercise with the U.S. Coast Guard in 2006 to test response to a simulation 
involving a suspicious boat approaching the island. In addition, DHS recently 
informed us that, in November 2007, it conducted a security exercise with 
more than 40 law enforcement officials. While these exercises are positive 
developments, further steps are needed, including testing the effectiveness of 
the response plan once it reflects lessons learned from these exercises and the 
new arrangements with local law enforcement. 

Reevaluating Risks and Threats 

Finally, in 2003, USDA had not sufficiently reevaluated the extent of the risks and 
threats to the security of Plum Island. For example, USDA had identified a list of 
threats that applied to all of its laboratories, but it had not reviewed these threats 
with the intelligence community and local law enforcement officials to ensure that 
threats particular to Plum Island and its vicinity were taken into consideration. The 
FBI, Suffolk County officials, and others told us at the time that they considered this 
step to be very important. DHS has since taken actions to respond to our 
recommendations to reconsider risks and threats to the security of Plum Island. For 
example, DHS officials told us they consult regularly with appropriate local law 
enforcement and intelligence agencies — including the U.S. Coast Guard, the FBI, FPS, 
and the Southold Police Department — to reconsider and update threats specific to 
Plum Island. 

Implementation of one of our recommendations to reevaluate the risks and threats to 
Plum Island remains in progress. Specifically, we recommended that DHS revise, as 
necessary, security and incident response plans to reflect any redefined risks, threats, 
and assets. Although we have asked DHS officials to provide us with an updated 
security plan, we have not seen evidence that the security plan has been reviewed 
since 2004. 

Concluding Observations 

DHS has made significant progress in the years since 2003, implementing most of our 
recommendations. Whether Plum Island continues to operate in its current capacity 
or as a higher level biosecurity facility, it is important that DHS fully implement the 
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remaining recommendations to reduce the risk of pathogen theft and to enhance 
response capabilities at Plum Island. 



We are sending copies of this report to the appropriate congressional committees, the 
Secretaries of Agriculture and Homeland Security, and other interested parties. We 
will also make copies available to others upon request. In addition, the report will be 
available at no charge on the GAO Web site at http://www.gao.gov. 

If you or your staff have any questions about this report or need additional 
information, please contact me at (202) 512-3841 or shamesl@gao.gov. Contact points 
for our Offices of Congressional Relations and Public Affairs may be found on the last 
page of this report. Key contributors to this report are listed in enclosure II. 




Lisa Shames 

Director, Natural Resources 
and Environment 



Enclosures 
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Chairman 
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Ranking Member 
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Chairman 
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Ranking Member 
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The Honorable Collin C. Peterson 
Chairman 
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Ranking Member 
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House of Representatives 
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Chairman 
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House of Representatives 
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Chairman 
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House of Representatives 
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Enclosure I 



Status of GAO Recommendations on Plum Island Physical Security as of 

December 2007 



Recommendation 


Status 


Addressing physical security deficiencies 


1 . Fully implement the physical security measures. 


Implemented 



Address the specific security shortcomings identified by our Office of Special Investigations. 

2. The security force reports directly to the Administrative Contract Officer and not to the 
Security Director— it is important for the security force to report directly to the Security 
Director of Plum Island to ensure that security-related issues are handled promptly. 

3. There are no name or record checks given to contractors and visitors going into the 
biocontainment area. Contractors and visitors entering the biocontainment area could be 
checked for criminal charges (through the National Crime Information Center) before they 
are granted access. 

4. The area outside of the biocontainment and administrative building is surveilled by 
stationary closed-circuit television cameras, which are insufficient. Installing pan, tilt, and 
zoom closed-circuit television cameras in certain areas would enhance surveillance 
capabilities. 

5. The island is easily accessible to the general public by boat, and there are limited "no 
trespassing" signs present on the island to advise the public that it is a government 
facility — more "no trespassing" signs in those areas of the island that are easily 
accessible to the public by boat would address this condition. 

6. In the event of a fire, Plum Island is not always able to respond appropriately because 
the fire brigade has limited hours of operation. The security force could be cross-trained 
for fire rescues and therefore provide 24-hour coverage. 

7. The building used for overnight accommodations lacks panic alarms for emergency 
response. Panic alarms could be installed in the building and, when visitors are present, 
security guards could drive by on a regular basis. 

8. Control for keys and master keys of the facility are deficient. The security department 
could be assigned the responsibility for all keys and master keys. A key log could be 
created to better track possession of keys. 



In progress 

Implemented 

Implemented 

Implemented 
Implemented 
Implemented 



9. Better secure certain features of the physical infrastructure that supports the continued 
operation of the Plum Island Animal Disease Center. 

10. Better secure the foot-and-mouth disease vaccine bank. 



Implemented 



Implemented 



Limiting access to pathogens 



1 1 . Ensure that all individuals involved in laboratory activities in the biocontainment area — 
including students and regardless of citizenship— have been approved in accordance with 
the law. 



In progress 



12. Ensure that background checks of individuals involved in laboratory activities in 


Implemented 


biocontainment are updated regularly. 




13. Ensure that cleaning, maintenance, and repair staff entering the biocontainment area are 


Implemented 


escorted at all times by individuals with completed background checks. 




14. Consult with other laboratories to identify ways to mitigate the inherent difficulty of securing 


Implemented 


pathogens. 




Enhancing incident response capability 


15. Resolve the issue of the guards' authority to carry firearms and make arrests. 


Implemented 


16. Develop and implement a policy on how guards should deal with intruders and use 


Implemented 


weapons. 




17. Increase the size of the guard force. 


Implemented 


18. Complete an agreement with local law enforcement agencies to ensure backup assistance 


Implemented 


when needed. 




19. Define an adequate response time for law enforcement to respond to incidents. 


Implemented 
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Recommendation 


Status 


20. Develop an incident response plan that includes precise detail about what to do in the 


In progress 


event an incident occurs that exceeds the capability of the security system, such as a 




terrorist attack. 




21 . Conduct exercises with local law enforcement to test the efficiency and effectiveness of 


In progress 


Plum Island's response capability. 




Reevaluating risks and threats 


22. Reconsider the security risks at Plum Island, taking into account recent acts of disgruntled 


Implemented 


employees. 




23. Consult with appropriate state and local law enforcement and intelligence agencies to 


Implemented 


revisit the threats specific to the Plum Island Animal Disease Center. 




24. Revise, as necessary, security and incident response plans to reflect any redefined risks, 


In progress 


threats, and assets. 





Source: GAO. 



Note: The recommendations listed in this table were made in GAO-03-847. 
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Enclosure II 



GAO Contact and Staff Acknowledgments 



GAO Contact 

Lisa Shames, (202) 512-3841, or shamesl@gao.gov 
Staff Acknowledgments 

In addition to the individual named above, Charles Adams, Assistant Director, and 
Mary Denigan-Macauley made key contributions to this report. Kevin Bray, Nancy 
Crothers, Jennifer Gregory, Barbara Patterson, and Raymond Rodriguez also made 
important contributions. 
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